EP2912802B1 - Procédé et un dispositif pour simuler un réseau resistant contre les attaques - Google Patents

Procédé et un dispositif pour simuler un réseau resistant contre les attaques Download PDF

Info

Publication number
EP2912802B1
EP2912802B1 EP13786119.1A EP13786119A EP2912802B1 EP 2912802 B1 EP2912802 B1 EP 2912802B1 EP 13786119 A EP13786119 A EP 13786119A EP 2912802 B1 EP2912802 B1 EP 2912802B1
Authority
EP
European Patent Office
Prior art keywords
data
network
cyber
farm
threat
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Active
Application number
EP13786119.1A
Other languages
German (de)
English (en)
Other versions
EP2912802A1 (fr
Inventor
Suzanne P. Hassell
Paul F. Beraud Iii
Alen Cruz
Gangahar GANGA
Brian J. MASTROPIETRO
Travis C. HESTER
David A. HYDE
Justin W. Toennies
Stephen R. Martin
Frank PIETRYKA
Niraj K. SRIVASTAVA
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Raytheon Co
Original Assignee
Raytheon Co
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Raytheon Co filed Critical Raytheon Co
Publication of EP2912802A1 publication Critical patent/EP2912802A1/fr
Application granted granted Critical
Publication of EP2912802B1 publication Critical patent/EP2912802B1/fr
Active legal-status Critical Current
Anticipated expiration legal-status Critical

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1433—Vulnerability analysis
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1441—Countermeasures against malicious traffic

Definitions

  • Cyber security is a global issue of growing importance. Cyber espionage can affect technical, military, political and economic interests anywhere. Attacks are no longer direct; they are increasingly sophisticated and stealthy.
  • Cyber resiliency of systems and networks ensures mission survivability in a cyber compromised environment. Resilient computer network defense anticipate the emergence of new vulnerabilities, take action to avoid threat actors seeking to exploit these vulnerabilities, and disrupt the actions of successful intruders to increase their work factor and minimize their impact. The focus of resiliency is the assumption that the attackers are inside the network, they cannot be detected, and yet mission survivability is the objective. The task of the cyber analyst is to effectively manage the security risk of his or her mission operating environment, and in the course of daily duties, mitigate cyber threats and vulnerabilities.
  • Network mapping and vulnerability identification tools such as Nessus®, Nmap® and other cyber security tools have existed for a long time and are useful for identifying vulnerabilities in commercial off-the-shelf (COTS) components typically found in enterprise IT networks.
  • COTS commercial off-the-shelf
  • these static capabilities do not provide the dynamic nature of resiliency techniques or for "what-if' scenarios and 0-day vulnerability risk management assessments.
  • Cyber-attack dynamic simulations consider target modeled networks, cyber-attack threads and applied defenses to generate cyber-attack success/failure metrics, such as percent attack success and time attack spends in each attack phase.
  • cyber-attack success/failure metrics such as percent attack success and time attack spends in each attack phase.
  • resultant target network function and performance degradation and collateral damage post cyber-attack aren't well analyzed or depicted.
  • these tools do not have timing as a component thereby making them unsuitable to model dynamic defenses.
  • US 7 315 801 B1 discloses a network security modeling system which simulates a network and analyzes security vulnerabilities of the network.
  • the system includes a simulator which includes a network vulnerabilities database and a network configuration module having network configuration data.
  • the simulator determines vulnerabilities of the simulated network based on the network configuration data and the vulnerabilities database.
  • the present disclosure provides a method for providing a cyber modeling and simulation framework, comprising: receiving, at an ingest interface, network and vulnerability data associated with a node of a targeted network; presenting, on a network visualization device, the network data and the vulnerability data; creating a network model based on the network and vulnerability data presented on the network visualization device; simulating a launching of threat attacks on the targeted network; applying, to the simulated launching of threat attacks, modeled defenses against the threat attacks; producing results from the simulating the launching of threat attacks and the applying the modeled defenses; characterized by the steps of: performing data farming on the simulation results using different scenarios to generate a farm of data, wherein data farming includes simulating the launching of same threat attacks on the targeted network to determine a statistically significant representation of the results when one or more of the threat attacks includes emergent behavior and an unpredictable characteristic; and designing anti-cyber-attack strategies for the targeted network based on the performing the data farming.
  • the present disclosure provides a cyber modeling and simulation framework, comprising: an interface for ingest of network and vulnerability data associated with a node of a targeted network; a network visualization device for presenting the network data and the vulnerability data , and for creating a network model based on the network and vulnerability data; a threat analysis simulator for launching threat attacks on the targeted network and for applying modeled defenses against the threat attacks, the threat analysis simulator producing simulation results; and characterized by: a data farming module for performing data farming on the simulation results using different scenarios to generate a farm of data for use in designing anti-cyber-attack strategies for the targeted network; wherein data farming includes launching of same threat attacks on the targeted network to determine a statistically significant representation of the results when one or more of the threat attacks includes emergent behavior and an unpredictable characteristic.
  • Embodiments described herein provide a cyber analysis modeling evaluation for operations (CAMEO) simulation system that models cyber threats and agile defense techniques in order to enable the cyber analyst to evaluate the cyber resiliency of systems and networks.
  • Military infrastructure and other networks to be modeled are typically a combination of COTS, government off-the-shelf (GOTS) and custom components, and can have both Internet Protocol (IP) and non-IP network segments and links.
  • IP Internet Protocol
  • a cyber threat, vulnerability and defense modeling and simulation tool kit is used for evaluation of systems and networks to improve cyber resiliency. This capability is used to help increase the resiliency of networks at various stages of their lifecycle, from initial design and architecture through the operation of deployed systems and networks.
  • Resiliency of computer systems and networks to cyber threats is facilitated by the modeling of agile and resilient defenses versus threats and running multiple simulations evaluated against resiliency metrics. This helps network designers, cyber analysts and security operations center personnel to perform trades using what-if scenarios to select resiliency capabilities and optimally design and configure cyber resiliency capabilities for their systems and networks.
  • the cyber analysis modeling evaluation for operations (CAMEO) simulation system provides a cyber defense simulation toolkit to evaluate risk and enhance the resiliency of networks in the face of cyber-attacks. Its goal is to provide a scalable, modular, distributed architecture and framework for cyber resiliency visualization and simulation to support the evaluation and selection of agile and resilient techniques during planning and operations of tactical mobile networks and other mission networks.
  • the system models and simulates the interactions between threats, defensive strategies, networks, mission functions, and vulnerabilities.
  • This simulation space is itself a complex system, a system of many parts which are coupled in a nonlinear fashion. Because they are nonlinear, complex systems are more than the sum of their parts and are likely to exhibit non-linear effects such as emergent behavior based upon the interaction and relationships of the parts and extreme sensitivity to initial conditions.
  • Data farming techniques allow systems with nonlinear interactions to be modeled and computed to study complex dynamics and unpredictability. Metrics for evaluation of generic resiliency aspects may be pulled from across various industries, including safety, telecommunications, infrastructure protection etc.
  • a scalable, modular, distributed architecture and framework according to an embodiment is provided for cyber agile defense visualization and simulation to support the selection and configuration of the most effective active defenses and attack detection mechanisms during planning and operations of tactical mobile networks and other mission networks.
  • a cyber analyst may therefore perform active cyber defense planning, modeling of vulnerability assessment and remediation inputs, operational course of action (COA) recommendations for active cyber remediation planning and gather and analyze cyber resilient defense metrics to select resilient techniques
  • Fig. 1 illustrates software and systems development, planning, and operations phases for mission assurance phases of a system 100 according to an embodiment.
  • software and systems development 110 leads to planning 120.
  • the planning 120 supports operations130.
  • the operations 130 provide software and/or systems technology refresh 132.
  • a vulnerability identification process 112 is used to identify and characterize vulnerabilities.
  • a model 122 according to an embodiment allows comparison of vulnerabilities to threats, sensors to threats, defenses to threats, etc. Threat evolution and periodic evaluation 134 take place between the planning phase 120 and the operations phase 130.
  • a model 136 according to an embodiment provides threat recognition at the operations phase. The threat recognition provided by model 136 allows adjustment of defenses 138.
  • the vulnerability identification process 112 leads to software and systems hardening 114.
  • the system model 122 that allows comparison of vulnerabilities to threats, sensors to threats, defenses to threats, etc., supports vulnerabilities and patching prioritization and timing 124 and active defenses and sensors placement and configuration 126.
  • the planning phase 120 may be used to support the Design System Security Architecture and Develop Detailed Security Design phases of NIST SP 800-37 and the Concept and Development phases of the Committee on National Security Systems Instruction (CNSSI) No. 1253.
  • Fig. 2 illustrates a system 200 for the modeling and simulation analysis process according to an embodiment.
  • Node data of a targeted network of interest 210 may first be scanned using a vulnerability scanning tool 212, such as Nessus®.
  • the system 200 may not be connected to the network 210 under study physically, but ingests data produced by tools 212 that may be connected to the network in order to provide a simulated target network topology.
  • An agent framework handles information changes.
  • the system 200 initiates a discrete simulation (DSIM) 240 and launches simulated threat attacks that seek to reach the final attack phase, i.e., exploitation on a target node in the modeled network.
  • Defenses are modeled that can be applied independently or in combination, while attacks are taking place on the simulated target network 210.
  • a system sensor agent 220 initially publishes a network 210, wherein devices and connection agents 222 are populated.
  • a network vulnerability scanner 212 may scan a network of interest (NOI) 210 and provide the results to a database 250 in the system 200.
  • NOI network of interest
  • One aspect of the system 200 involves the importing of data into the system 200 and creating visualization of the imported data.
  • An ingest service such as network vulnerability scanners 212, provides a single common interface for disparate authoritative sources of device, application, hardware, vulnerability, and weakness data, and automates the enrichment and correlation of the data. Through ingestion of network configurations, vulnerabilities and platforms, the system 200 makes modeling more automatic. The data ingest may be triggered manually from a graphical user interface 232 accessed by an analyst 230.
  • Network topologies may be input into the database 250 via import from vulnerability scanning tools, such as Nessus® or Nmap®. Additional components, connections etc. are added or changed via the GUI or a network visualization (NVIS) tool to match the actual network topology. This may also be used to support "what-if' architecture changes for resiliency evaluation and trade-offs.
  • vulnerability scanning tools such as Nessus® or Nmap®.
  • Additional components, connections etc. are added or changed via the GUI or a network visualization (NVIS) tool to match the actual network topology. This may also be used to support "what-if' architecture changes for resiliency evaluation and trade-offs.
  • Data sources 260 such as proprietary data sources and administered data sources (e.g., MTRE), provide vulnerability threats to the database 250 (e.g., data warehouse).
  • the system 200 may use data sources including common platform enumeration (CPE) dictionary for hardware, application, operating systems, national vulnerability database, common vulnerability enumeration (NVD-CVE) for vulnerabilities with associated metrics and affected CPEs, common weakness enumeration (CWE) for weaknesses with potential mitigation approaches, common attack pattern enumeration and classification (CAPEC), which is a catalog of attack patterns and associated CPE, NVD configurations and others.
  • CPE common platform enumeration
  • NDVD-CVE common vulnerability enumeration
  • CWE common weakness enumeration
  • CAPEC common attack pattern enumeration and classification
  • the database 250 stores resultant data from scenario runs to facilitate ease of analysis.
  • the data warehouse implements a database structure to manage the various technical specifications of technologies being modeled.
  • the database 250 also facilitates integration with collaboration tools through standards based interfaces.
  • the database 250 may be manipulated using data editors 252.
  • the scanned results of the NOI and the threat data 254 may be provided to the analyst 230.
  • the analyst 230 may build and edit scenarios.
  • the network visualization monitor agent 270 enables the analyst/user to manipulate and visualize the various aspects of the target network 210 being simulated and to conduct operations on its component tree and their interconnections.
  • the network visualization monitor agent 270 monitors the devices and connections 222 from the system sensor agent 220 and visualizes them in simulated real time. New vulnerabilities may be defined and new platforms and components added to the modeled network to provide "what-if" simulations.
  • plug-in and extensible threat and defense templates 234 allows the model to be maintained for evolving threats.
  • the system 200 also allows creation of custom vulnerabilities and platform identifiers in the model GUI to support custom components or embedded systems in addition to COTS, and the creation of custom vulnerabilities for "what-if' capabilities for potential zero day vulnerability risk assessment.
  • the network topology may be entered by the analyst 230 into the system via GUI menus 232 or NVIS tools 270.
  • the device and connection agent 222 are used by a DSIM monitor agent 242 to run simulations of NOI 210 against various threats with defenses which in turn publishes simulation effects on devices. Simulations may be run against threats and defenses.
  • a discrete simulation (DSIM) 240 may be executed to produce analyzed and visualized DSIM results 244.
  • the DSIM 240 may include network, attack and defense simulations.
  • the DSIM monitor agent 242 is used by a scenario builder agent 254 to combine network and threats and submit the scenario to run data farming to produce DSIM results 244. From the DSIM results 244, at least one recommended course of action 280 may be identified by the system 200.
  • a network security officer 290 may then receive the recommended course of action 282 and take action 292.
  • the use of an agent architecture for the simulated network 210 provides play-back of selected cyber-attacks on a network and the defenses in simulated real-time to increase understanding of the cyber analyst 230.
  • the system 200 is arranged to provide a scalable, modular, distributed architecture and framework for cyber agile defense visualization and simulation to support the selection and configuration of the most effective active defenses and attack detection.
  • the architecture development for the system 200 includes several guiding quality attributes, such as extensibility and scalability, which may be supported by architecture components as described herein below.
  • the system 200 provides dynamic modeling and simulation for determining cyber threat risk to specific networks and systems, and evaluation of resilient defenses for "what-if' scenarios and 0-day vulnerabilities.
  • the system 200 supports IP and non-IP networks.
  • An extensible library of threats and defenses templates 234 may be developed and used in the modeling and simulation of cyber threats.
  • the system 200 provides a temporal component for evaluation of dynamic, agile defenses. Visualization tools are provided by the network visualization monitor agent 270 to provide illustrations of the threat scenarios.
  • the system 200 may be used to evaluate different candidate architectures.
  • the analyst 230 may select and evaluate the defense configuration and tools in the context of the network design and potential threats.
  • the analyst 230 may evaluate resiliency methods, services, tools, and algorithms to fit the planned network.
  • the system 200 supports the architecture tradeoffs by repeated execution of the model using different configurations and even placements of the defenses based upon identification of the variable defenses by the analyst 230 through a graphical user interface (GUI) 232.
  • GUI graphical user interface
  • Several varieties of each type of defense may be selected to trade-off with costs assigned to each one. This supports cost tradeoffs for vendor equipment and resiliency techniques to be made to provide a more cost effective security architecture.
  • Cyber resiliency techniques selected originally for the network 210 may typically be adapted and updated during operations to handle evolving threats as well as planned network changes. Changing missions or goals may change the criticality of systems or networks involved in the mission, creating the need to reconfigure existing cyber resiliency defenses or deploy different resiliency techniques. Some examples include the cyber maneuver interval, reconstitution interval or operating system diversity ratios.
  • Fig. 3 illustrates a map of the data flow 300 for the cyber analysis modeling evaluation for operations simulation system according to an embodiment.
  • data is post-processed to narrow the output of the data farming into a grouping of the data of interest. This post-processing is primarily based upon resiliency metrics and their values. From these selections, results can be visualized using the DSIM Monitor, saved for further reference, and used to create course of action (COA) recommendations.
  • COA course of action
  • Fig. 3 the system joins 310 model threats/defenses 320 and model target networks 322.
  • the model target network data may be used to provide a visualization of the networks 324.
  • Scenarios 330 are maintained in a data farm and provided to a simulator 340 for simulation of the threat and defense acting on the network.
  • a visualization tool may be used to visualize the attacks 342.
  • Results metrics from the simulation 350 are provided for post-processing.
  • the attack metrics may also be visualized for analysis 352.
  • the results metrics 350 are converted to resultant mission operations capability 360.
  • the resultant mission operational capability 360 may then be presented visually 362.
  • Metrics 350 may be used to evaluate resiliency techniques and cyber threats. Through the definition of these metrics 350, time becomes the fundamental measure of success and effectiveness. As examples, metrics 350 are described below, wherein these metrics 350 are a subset of those used to evaluate such techniques as cyber maneuver, deception and reconstitution, and to provide the optimal dynamic configuration of these techniques in an evolving threat environment.
  • large multi-case scenario results 370 may be managed.
  • the large dataset results 370 may be analyzed to publish a course of action recommendations 380.
  • the process may be reiterated 390 to further refine the analysis conditions.
  • Fig. 4 illustrates a network node graphical editor screen 400 according to an embodiment.
  • the network visualization component of the system toolset enables the analyst/user to manipulate and visualize the various aspects of the target network being simulated and to conduct operations on its component tree and their interconnections.
  • Fig. 4 shows IP addresses 410, operating system and hardware icons 420, and interconnections 430 between them.
  • Image filters 442 may be selected.
  • a status overlay 446 may be selected for display 448.
  • Fig. 4 illustrates the vulnerability view wherein an "x" 450 indicates a vulnerability.
  • Fig. 5 represents a discrete simulation (DSIM) 500 for producing analyzed and visualized DSIM results according to an embodiment.
  • the DSIM 500 pits threats 510 against the target network 520 and any applied defenses 530.
  • Scenario file scripts 540 may be used to assign simulation component files for different scenarios, including threats, defenses and type of attacks. There may be single or multiple threats 550, multiple, simultaneous attacks 552, single or multiple defenses 554. The scenarios may be applied to the network 520. The attack results are noted and the simulation results are provided to database 560.
  • the threats in the threat library used as templates 540 may be Java models, with embedded behavior. These threat models templates 540 are extremely flexible. Typically, one of the existing threat model templates 540 may be configured through the GUI, and the threat model behavior may be set by network topography, e.g., connectivity, or timing without having to develop a new java model. In circumstances where the threat library cannot be included, or in cases where new threat behavior or specialized or proprietary threats are used, new java threats may be created. Similarly to developing a threat model, a new defense or resilience technique model can be developed using the defense models as templates. Simulations and evaluations of new resiliency techniques may be simulated prior to investing in full-scale development of a resiliency technique as part of a system or product.
  • the simulation shows threats 510 against the NOI 520.
  • the defenses 530 repel some of the attacks.
  • one attack 570 passes through the defenses 530 and is able to attack the NOI 520.
  • one network node is exploited 580 and one network node is infected 582.
  • the simulation results are then provided to a database 560.
  • Fig. 6 illustrates a data farming process 600 according to an embodiment.
  • Data Farming 600 involves generating and assimilating the results of different scenarios for investigation of a wide number of variables across a wide range of values multiple times.
  • the data farming process 6000 starts with defining of a problem 610.
  • An experimental design may be developed 620.
  • a simulation model 630 is created based on the experimental design.
  • data is stored in servers 640, wherein data farming 642 may be performed.
  • data farming 642 the user may model combinations and variations within the data space and grow resulting data in an iterative process attempting to answer questions at hand.
  • Data farming 642 is used to perform enough simulations to evaluate the architecture of a small network in a "reasonable time" (e.g., 4 hours). The study time is reduced significantly when input files are not generated. Furthermore, extrapolating the savings to the expected larger studies of more complex systems and scenarios shows the advantages of using data farming 642. Visualization is used to understand the locations of un-patched vulnerabilities and even for basic network understanding. After performing data farming 642, data may then be analyzed 650. Intuitive and counter-intuitive outcomes 660 for threats may be identified from the data analysis.
  • the data farming process 600 may be performed iterative by modifying any of the processes. Multiple runs of the same scenario are used to determine a statistically significant representation when working with cyber analysis models that have emergent behavior and unpredictable characteristics.
  • Fig. 7 shows the scenario playback screen 700 according to an embodiment.
  • Using the NVIS in a monitor commander view mode enables the viewing of a cyber attack's progress through the network by changes in attack phase icons 710 in the displayed network 712 as an attack scenario is played back.
  • the progression of a cyber attack is visualized as an animation, e.g., dynamic graphics, charts, icons, and other changing features, on a target network depiction.
  • Information regarding the threat characteristics 730 and the current target 750 may be presented proximate to the network visualization 712.
  • the threat characteristics 730 that may be presented include the type of threat 732, a description 734, the target hardware 736, the target hypervisor 738, the target operating system 740, the target application 742, threat phases 744 and vulnerabilities 746.
  • Information regarding the current target 750 may include the type of target 752, the IP address of the target 754, the hardware processor 756, the hypervisor 758, the operating system 760 and the application 762.
  • the cyber analysis modeling evaluation for operations (CAMEO) simulation system may be used to provide cyber resiliency of systems and networks for ensuring mission survivability in a cyber compromised environment.
  • the cyber threat simulation system provides a cyber defense simulation toolkit to evaluate and enhance the resiliency of networks in the face of cyber-attacks.
  • the system provides a scalable, modular, distributed architecture and framework for resilient cyber dynamic defense visualization and simulation to support the selection and configuration of the most effective agile defenses and attack detection mechanisms during planning and operations of tactical mobile networks and other mission networks.
  • Cyber effects modeling converts user defined target functionality/criticality/susceptibility and cyber-attack results into resultant target network operational/nonoperational depiction and metrics. These results directly support operational cost effectiveness analyses for cyber products and system architecture improvements.
  • the modeling of cyber effects enables believable and relevant costing of cyber-attack and defense events/capabilities in operational systems.
  • the framework of the system abstracts system configurations, network topologies, vulnerabilities, attack methods, and detection methods from the individual simulation engines to provide portability between multiple simulation engines and to ensure compatibility with other cyber analysis tools.
  • the system may run on a personal computer and may take advantage of compute grids and supercomputers to reduce time to solution and to address analysis with a greater fidelity.
  • a data farming interface automates the processes from the experimental design through the data farming and virtualizes the interface to the high performance computing (HPC) system thus allowing access to COTS HPC clusters and cloud systems.
  • HPC high performance computing
  • Fig. 8 illustrates a block diagram of an example machine 800 for providing a cyber-analysis modeling evaluation for operations (CAMEO) simulation system according to an embodiment upon which any one or more of the techniques (e.g., methodologies) discussed herein may perform.
  • the machine 800 may operate as a standalone device or may be connected (e.g., networked) to other machines.
  • the machine 800 may operate in the capacity of a server machine and/or a client machine in server-client network environments.
  • the machine 800 may act as a peer machine in peer-to-peer (P2P) (or other distributed) network environment.
  • P2P peer-to-peer
  • the machine 800 may be a personal computer (PC), a tablet PC, a set-top box (STB), a Personal Digital Assistant (PDA), a mobile telephone, a web appliance, a network router, switch or bridge, or any machine capable of executing instructions (sequential or otherwise) that specify actions to be taken by that machine.
  • PC personal computer
  • PDA Personal Digital Assistant
  • STB set-top box
  • PDA Personal Digital Assistant
  • mobile telephone a web appliance
  • network router, switch or bridge or any machine capable of executing instructions (sequential or otherwise) that specify actions to be taken by that machine.
  • machine shall also be taken to include any collection of machines that individually or jointly execute a set (or multiple sets) of instructions to perform any one or more of the methodologies discussed herein, such as cloud computing, software as a service (SaaS), other computer cluster configurations.
  • SaaS software as a service
  • Examples, as described herein, may include, or may operate on, logic or a number of components, modules, or mechanisms.
  • Modules are tangible entities (e.g., hardware) capable of performing specified operations and may be configured or arranged in a certain manner.
  • circuits may be arranged (e.g., internally or with respect to external entities such as other circuits) in a specified manner as a module.
  • at least a part of one or more computer systems (e.g., a standalone, client or server computer system) or one or more hardware processors 802 may be configured by firmware or software (e.g., instructions, an application portion, or an application) as a module that operates to perform specified operations.
  • the software may reside on at least one machine readable medium.
  • the software when executed by the underlying hardware of the module, causes the hardware to perform the specified operations.
  • module is understood to encompass a tangible entity, be that an entity that is physically constructed, specifically configured (e.g., hardwired), or temporarily (e.g., transitorily) configured (e.g., programmed) to operate in a specified manner or to perform at least part of any operation described herein.
  • modules are temporarily configured, a module need not be instantiated at any one moment in time.
  • the modules comprise a general-purpose hardware processor 802 configured using software; the general-purpose hardware processor may be configured as respective different modules at different times.
  • Software may accordingly configure a hardware processor, for example, to constitute a particular module at one instance of time and to constitute a different module at a different instance of time.
  • application or variants thereof, is used expansively herein to include routines, program modules, programs, components, and the like, and may be implemented on various system configurations, including single-processor or multiprocessor systems, microprocessor-based electronics, single-core or multi-core systems, combinations thereof, and the like.
  • application may be used to refer to an embodiment of software or to hardware arranged to perform at least part of any operation described herein.
  • Machine 800 may include a hardware processor 802 (e.g., a central processing unit (CPU), a graphics processing unit (GPU), a hardware processor core, or any combination thereof), a main memory 804 and a static memory 806, at least some of which may communicate with others via an interlink (e.g., bus) 808.
  • the machine 800 may further include a display unit 810, an alphanumeric input device 812 (e.g., a keyboard), and a user interface (UI) navigation device 814 (e.g., a mouse).
  • the display unit 810, input device 812 and UI navigation device 814 may be a touch screen display.
  • the machine 800 may additionally include a storage device (e.g., drive unit) 816, a signal generation device 818 (e.g., a speaker), a network interface device 820, and one or more sensors 821, such as a global positioning system (GPS) sensor, compass, accelerometer, or other sensor.
  • the machine 800 may include an output controller 828, such as a serial (e.g., universal serial bus (USB), parallel, or other wired or wireless (e.g., infrared (IR)) connection to communicate or control one or more peripheral devices (e.g., a printer, card reader, etc.).
  • a serial e.g., universal serial bus (USB), parallel, or other wired or wireless (e.g., infrared (IR)) connection to communicate or control one or more peripheral devices (e.g., a printer, card reader, etc.).
  • USB universal serial bus
  • IR infrared
  • the storage device 816 may include at least one machine readable medium 822 on which is stored one or more sets of data structures or instructions 824 (e.g., software) embodying or utilized by any one or more of the techniques or functions described herein.
  • the instructions 824 may also reside, at least partially, additional machine readable memories such as main memory 804, static memory 806, or within the hardware processor 802 during execution thereof by the machine 800.
  • main memory 804, static memory 806, or the storage device 816 may constitute machine readable media.
  • machine readable medium 822 is illustrated as a single medium, the term “machine readable medium” may include a single medium or multiple media (e.g., a centralized or distributed database, and/or associated caches and servers) that configured to store the one or more instructions 824.
  • machine readable medium may include a single medium or multiple media (e.g., a centralized or distributed database, and/or associated caches and servers) that configured to store the one or more instructions 824.
  • machine readable medium may include any medium that is capable of storing, encoding, or carrying instructions for execution by the machine 800 and that cause the machine 800 to perform any one or more of the techniques of the present disclosure, or that is capable of storing, encoding or carrying data structures used by or associated with such instructions.
  • Nonlimiting machine readable medium examples may include solid-state memories, and optical and magnetic media.
  • machine readable media may include: non-volatile memory, such as semiconductor memory devices (e.g., Electrically Programmable Read-Only Memory (EPROM), Electrically Erasable Programmable Read-Only Memory (EEPROM)) and flash memory devices; magnetic disks, such as internal hard disks and removable disks; magneto-optical disks; and CD-ROM and DVD-ROM disks.
  • non-volatile memory such as semiconductor memory devices (e.g., Electrically Programmable Read-Only Memory (EPROM), Electrically Erasable Programmable Read-Only Memory (EEPROM)) and flash memory devices
  • EPROM Electrically Programmable Read-Only Memory
  • EEPROM Electrically Erasable Programmable Read-Only Memory
  • flash memory devices e.g., electrically Erasable Programmable Read-Only Memory (EEPROM)
  • EPROM Electrically Programmable Read-Only Memory
  • EEPROM Electrically Erasable Programmable Read-Only Memory
  • flash memory devices e.g., electrically Era
  • the instructions 824 may further be transmitted or received over a communications network 826 using a transmission medium via the network interface device 820 utilizing any one of a number of transfer protocols (e.g., frame relay, internet protocol (IP), transmission control protocol (TCP), user datagram protocol (UDP), hypertext transfer protocol (HTTP), etc.).
  • transfer protocols e.g., frame relay, internet protocol (IP), transmission control protocol (TCP), user datagram protocol (UDP), hypertext transfer protocol (HTTP), etc.
  • Example communication networks may include a local area network (LAN), a wide area network (WAN), a packet data network (e.g., the Internet), mobile telephone networks ((e.g., channel access methods including Code Division Multiple Access (CDMA), Time-division multiple access (TDMA), Frequency-division multiple access (FDMA), and Orthogonal Frequency Division Multiple Access (OFDMA) and cellular networks such as Global System for Mobile Communications (GSM), Universal Mobile Telecommunications System (UMTS), CDMA 2000 1x* standards and Long Term Evolution (LTE)), Plain Old Telephone (POTS) networks, and wireless data networks (e.g., Institute of Electrical and Electronics Engineers (IEEE) 802 family of standards including IEEE 802.11 standards (WiFi), IEEE 802.16 standards (WiMax®) and others), peer-to-peer (P2P) networks, or other protocols now known or later developed.
  • LAN local area network
  • WAN wide area network
  • packet data network e.g., the Internet
  • mobile telephone networks
  • the network interface device 820 may include one or more physical jacks (e.g., Ethernet, coaxial, or phone jacks) or one or more antennas to connect to the communications network 826.
  • the network interface device 820 may include a plurality of antennas to wirelessly communicate using at least one of single-input multiple-output (SIMO), multiple-input multiple-output (MIMO), or multiple-input single-output (MISO) techniques.
  • SIMO single-input multiple-output
  • MIMO multiple-input multiple-output
  • MISO multiple-input single-output
  • transmission medium shall be taken to include any intangible medium that is capable of storing, encoding or carrying instructions for execution by the machine 800, and includes digital or analog communications signals or other intangible medium to facilitate communication of such software.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Computer And Data Communications (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Claims (15)

  1. Procédé d'utilisation d'une structure de cyber-modélisation et de simulation, comprenant :
    la réception, au niveau d'une interface d'ingestion, des données de réseau et de vulnérabilité associées à un noeud d'un réseau ciblé (210) ;
    la présentation, sur un dispositif de visualisation de réseau (270), des données de réseau et des données de vulnérabilité ;
    la création d'un modèle de réseau basé sur les données de réseau et de vulnérabilité présentées sur le dispositif de visualisation de réseau (270) ;
    la simulation d'un lancement d'attaques de menace sur le réseau ciblé (210) ;
    l'application, au lancement simulé d'attaques de menace, de défenses modélisées contre les attaques de menace ;
    la production de résultats à partir de la simulation du lancement d'attaques de menace et de l'application des défenses modélisées ;
    caractérisé par les étapes de :
    réalisation d'une exploitation de données sur les résultats de simulation par utilisation de différents scénarios pour produire une exploitation de données, l'exploitation de données comprenant la simulation du lancement des mêmes attaques de menace sur le réseau ciblé (210) pour déterminer une représentation statistiquement significative des résultats lorsqu'au moins une des attaques de menace comprend un comportement émergent et une caractéristique imprévisible ; et
    conception de stratégies de lutte contre les cyberattaques pour le réseau ciblé (210) basées sur la réalisation de l'exploitation de données.
  2. Procédé selon la revendication 1, dans lequel la conception de stratégies de lutte contre les cyberattaques comprend la conception de stratégies de lutte contre les cyberattaques basées sur l'identification d'un point d'inflexion métrique dans l'exploitation de données ; et
    dans lequel l'identification du point d'inflexion métrique dans l'exploitation de données comprend la visualisation de l'exploitation de données par utilisation du dispositif de visualisation de réseau et par analyse de l'exploitation de données visualisée pour détecter le point d'inflexion métrique.
  3. Procédé selon la revendication 1, comprenant en outre le balayage du réseau en utilisant un scanneur de vulnérabilité (212) pour acheminer les données associées au noeud du réseau ciblé (210) à l'interface d'ingestion.
  4. Procédé selon la revendication 1, dans lequel la présentation, sur le dispositif de visualisation de réseau (270), des données de réseau et des données de vulnérabilité comprend en outre la manipulation et la visualisation du réseau ciblé (210) simulé et la conduite d'opérations sur une arborescence de composants et sur des interconnexions associées au réseau ciblé (210).
  5. Procédé selon la revendication 1, dans lequel la simulation du lancement d'attaques de menace et l'application des défenses modélisées comprend en outre l'établissement des attaques de menace en opposition avec le réseau ciblé (210) et les défenses sélectionnées.
  6. Procédé selon la revendication 1, comprenant en outre :
    le stockage des données résultant des exécutions de scénario créées par la simulation du lancement d'attaques de menace et l'application des défenses modélisées et l'accès aux données stockées en résultant ; ou
    la présentation de l'exploitation de données pour post-traitement, afin de réduire une sortie de l'exploitation de données en un regroupement de données d'intérêt en fonction de métriques de résilience.
  7. Procédé de la revendication 1, dans lequel la réalisation de l'exploitation de données comprend en outre la production de l'exploitation de données en fonction de métriques utilisées pour évaluer les techniques de résilience et les cybermenaces.
  8. Procédé selon la revendication 1, dans lequel la réception, au niveau de l'interface d'ingestion, des données de réseau et de vulnérabilité, comprend en outre la réception des données de réseau et de vulnérabilité au niveau d'une interface commune unique pour des sources officielles disparates de données de dispositifs, d'applications, de matériel, de vulnérabilité et de faiblesse.
  9. Structure de cyber-modélisation et de simulation, comprenant :
    une interface d'ingestion de données de réseau et de vulnérabilité associées à un noeud d'un réseau ciblé (210) ;
    un dispositif de visualisation de réseau (270) permettant de présenter les données de réseau et les données de vulnérabilité, et permettant de créer un modèle de réseau en fonction des données de réseau et de vulnérabilité ;
    un simulateur d'analyse de menace (340) permettant de lancer des attaques de menace sur le réseau ciblé (210) et d'appliquer des défenses modélisées contre les cyberattaques, le simulateur d'analyse de menace (340) produisant des résultats de simulation ; et
    caractérisé par :
    un module d'exploitation de données permettant de réaliser une exploitation de données sur les résultats de simulation par utilisation de différents scénarios permettant de produire une exploitation de données à utiliser dans la conception de stratégies de lutte contre les cyberattaques, l'exploitation de données comprenant le lancement des mêmes attaques de menace sur le réseau ciblé pour déterminer une représentation statistiquement significative des résultats lorsqu'au moins une des attaques de menace comprend un comportement émergent et une caractéristique imprévisible.
  10. Structure de cyber-modélisation et de simulation selon la revendication 9, dans laquelle les stratégies de lutte contre les cyberattaques sont basées sur une identification d'un point d'inflexion métrique dans l'exploitation de données ; et
    dans laquelle l'identification du point d'inflexion métrique dans l'exploitation de données est basée sur la visualisation de l'exploitation de données par utilisation du dispositif de visualisation de réseau.
  11. Structure de cyber-modélisation et de simulation selon la revendication 9, comprenant en outre un scanneur de vulnérabilité (212) permettant d'acheminer les données associées au noeud du réseau ciblé (210) à l'interface d'ingestion.
  12. Structure de cyber-modélisation et de simulation selon la revendication 9, dans laquelle le dispositif de visualisation de réseau (270) est agencé pour manipuler et pour visualiser le réseau ciblé (210) simulé et pour conduire des opérations sur une arborescence de composants et sur des interconnexions associées au réseau ciblé (210).
  13. Structure de cyber-modélisation et de simulation selon la revendication 9, dans laquelle le simulateur d'analyse de menace (340) est agencé pour établir les attaques de menace en opposition avec le réseau ciblé (210) et avec les défenses sélectionnées.
  14. Structure de cyber-modélisation et de simulation selon la revendication 9 comprenant en outre :
    un entrepôt de données agencé pour stocker les données résultant d'exécutions de scénario exécutées par le simulateur d'analyse de menace (340), les données en résultant étant accessibles pour analyse, ou
    le dispositif de visualisation de réseau (270) est agencé pour présenter l'exploitation de données pour post-traitement afin de réduire une sortie de l'exploitation de données en un regroupement de données d'intérêt en fonction de métriques de résilience.
  15. Structure de cyber-modélisation et de simulation selon la revendication 9, le module d'exploitation de données étant agencé pour produire l'exploitation de données en fonction de métriques utilisées pour évaluer les techniques de résilience et les cybermenaces ; ou
    l'interface pour l'ingestion de données étant agencée pour utiliser une interface commune unique pour des sources officielles disparates de données de dispositifs, d'applications, de matériel, de vulnérabilité et de faiblesse ; ou
    le dispositif de visualisation de réseau étant agencé pour visualiser une progression d'une cyberattaque animée sur l'illustration du réseau cible.
EP13786119.1A 2012-10-23 2013-10-23 Procédé et un dispositif pour simuler un réseau resistant contre les attaques Active EP2912802B1 (fr)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
US201261717360P 2012-10-23 2012-10-23
PCT/US2013/066378 WO2014066500A1 (fr) 2012-10-23 2013-10-23 Évaluation de modélisation analytique virtuelle destinée à un système de simulation d'opérations (cameo)

Publications (2)

Publication Number Publication Date
EP2912802A1 EP2912802A1 (fr) 2015-09-02
EP2912802B1 true EP2912802B1 (fr) 2018-11-21

Family

ID=49517770

Family Applications (1)

Application Number Title Priority Date Filing Date
EP13786119.1A Active EP2912802B1 (fr) 2012-10-23 2013-10-23 Procédé et un dispositif pour simuler un réseau resistant contre les attaques

Country Status (5)

Country Link
US (1) US9954884B2 (fr)
EP (1) EP2912802B1 (fr)
KR (1) KR101681855B1 (fr)
IL (1) IL238136B (fr)
WO (1) WO2014066500A1 (fr)

Families Citing this family (103)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2014066500A1 (fr) 2012-10-23 2014-05-01 Hassell Suzanne P Évaluation de modélisation analytique virtuelle destinée à un système de simulation d'opérations (cameo)
US10409980B2 (en) 2012-12-27 2019-09-10 Crowdstrike, Inc. Real-time representation of security-relevant system state
US9088541B2 (en) 2013-05-31 2015-07-21 Catbird Networks, Inc. Systems and methods for dynamic network security control and configuration
US11196636B2 (en) * 2013-06-14 2021-12-07 Catbird Networks, Inc. Systems and methods for network data flow aggregation
US9769174B2 (en) * 2013-06-14 2017-09-19 Catbird Networks, Inc. Systems and methods for creating and modifying access control lists
US9912549B2 (en) 2013-06-14 2018-03-06 Catbird Networks, Inc. Systems and methods for network analysis and reporting
US9544326B2 (en) * 2014-01-20 2017-01-10 Raytheon Company Digital weapons factory and digital operations center for producing, deploying, assessing, and managing digital defects
US9798882B2 (en) * 2014-06-06 2017-10-24 Crowdstrike, Inc. Real-time model of states of monitored devices
US9357397B2 (en) 2014-07-23 2016-05-31 Qualcomm Incorporated Methods and systems for detecting malware and attacks that target behavioral security mechanisms of a mobile device
EP3238407A4 (fr) * 2014-09-05 2018-08-15 Catbird Networks, Inc. Systèmes et procédés permettant de créer et de modifier des listes de contrôle d'accès
US9571517B2 (en) * 2014-11-11 2017-02-14 Goldman, Sachs & Co. Synthetic cyber-risk model for vulnerability determination
US9892260B2 (en) * 2015-04-20 2018-02-13 SafeBreach Ltd. System and method for creating and executing breach scenarios utilizing virtualized elements
US9710653B2 (en) * 2015-04-20 2017-07-18 SafeBreach Ltd. System and method for verifying malicious actions by utilizing virtualized elements
EP3360043A4 (fr) 2015-10-08 2019-04-24 Siege Technologies LLC Évaluation de l'efficacité de technologies de cybersécurité
US10609079B2 (en) * 2015-10-28 2020-03-31 Qomplx, Inc. Application of advanced cybersecurity threat mitigation to rogue devices, privilege escalation, and risk-based vulnerability and patch management
US11184401B2 (en) * 2015-10-28 2021-11-23 Qomplx, Inc. AI-driven defensive cybersecurity strategy analysis and recommendation system
US11070592B2 (en) * 2015-10-28 2021-07-20 Qomplx, Inc. System and method for self-adjusting cybersecurity analysis and score generation
US10432660B2 (en) * 2015-10-28 2019-10-01 Qomplx, Inc. Advanced cybersecurity threat mitigation for inter-bank financial transactions
US10135862B1 (en) * 2015-12-04 2018-11-20 Amazon Technologies, Inc. Testing security incident response through automated injection of known indicators of compromise
US10771359B2 (en) * 2015-12-14 2020-09-08 Fidessa Trading Uk Limited System capacity heatmap
US10079850B1 (en) * 2015-12-29 2018-09-18 Symantec Corporation Systems and methods for provisioning cyber security simulation exercises
US10230752B2 (en) 2016-02-24 2019-03-12 Verodin, Inc. Systems and methods for attack simulation on a production network
US10129289B1 (en) * 2016-03-11 2018-11-13 Shape Security, Inc. Mitigating attacks on server computers by enforcing platform policies on client computers
US10313382B2 (en) 2016-03-29 2019-06-04 The Mitre Corporation System and method for visualizing and analyzing cyber-attacks using a graph model
US9537884B1 (en) * 2016-06-01 2017-01-03 Cyberpoint International Llc Assessment of cyber threats
ES2728337T3 (es) * 2016-07-14 2019-10-23 Ironnet Cybersecurity Inc Simulación y realidad virtual basada en sistemas de comportamiento cibernético
CN106559414B (zh) * 2016-10-31 2018-02-27 华中科技大学 基于区域态势信息的网络攻击后果动态定量评估方法
US10243993B2 (en) * 2016-11-17 2019-03-26 Harris Corporation Systems and method for providing dynamic computer networks in which behavior models drive cyber mission models
US10547630B2 (en) * 2016-11-29 2020-01-28 Harris Corporation Systems and method for providing dynamic computer networks in which goal induced dynamic modifications to mission plans occur
KR101897395B1 (ko) * 2017-02-24 2018-09-10 국방과학연구소 사이버전 시나리오 작성 및 유효성 확인을 위한 표준 데이터 기반 보안 취약점 대응 방법 및 시스템
US10205736B2 (en) 2017-02-27 2019-02-12 Catbird Networks, Inc. Behavioral baselining of network systems
RU2649447C1 (ru) * 2017-05-22 2018-04-03 Евгений Борисович Дроботун Способ выбора допустимых по стоимости вариантов построения системы защиты от компьютерных атак
WO2018233891A1 (fr) * 2017-06-23 2018-12-27 Robert Bosch Gmbh Outil d'interface utilisateur graphique pour configurer un système de détection d'intrusion d'un véhicule
CN111316268A (zh) * 2017-09-06 2020-06-19 分形工业有限公司 用于银行间金融交易的高级网络安全威胁抑制
US10764755B2 (en) 2017-09-07 2020-09-01 802 Secure, Inc. Systems and methods for providing wireless access security by interrogation
KR101916676B1 (ko) 2017-11-27 2018-11-08 한국인터넷진흥원 사이버 위협 인텔리전스 데이터를 수집하는 방법 및 그 시스템
US10990432B1 (en) * 2017-11-30 2021-04-27 Ila Corporation Method and system for interactive cyber simulation exercises
US20210042145A1 (en) * 2018-11-29 2021-02-11 Bernardo Starosta Method and System for Interactive Cyber Simulation Exercises
US10679164B2 (en) * 2017-12-01 2020-06-09 KnowBe4, Inc. Systems and methods for using artificial intelligence driven agent to automate assessment of organizational vulnerabilities
US11010233B1 (en) 2018-01-18 2021-05-18 Pure Storage, Inc Hardware-based system monitoring
US10970395B1 (en) 2018-01-18 2021-04-06 Pure Storage, Inc Security threat monitoring for a storage system
US20200026696A1 (en) * 2018-05-28 2020-01-23 Open Invention Network Llc Content attributes depicted in a social network
US11750633B2 (en) * 2018-09-27 2023-09-05 Riskq, Inc. Digital asset based cyber risk algorithmic engine, integrated cyber risk methodology and automated cyber risk management system
US11354325B2 (en) 2018-10-25 2022-06-07 Bank Of America Corporation Methods and apparatus for a multi-graph search and merge engine
US11741196B2 (en) 2018-11-15 2023-08-29 The Research Foundation For The State University Of New York Detecting and preventing exploits of software vulnerability using instruction tags
US10630726B1 (en) 2018-11-18 2020-04-21 Bank Of America Corporation Cybersecurity threat detection and mitigation system
US10824676B2 (en) 2018-11-29 2020-11-03 Bank Of America Corporation Hybrid graph and relational database architecture
CN110134998A (zh) * 2019-04-11 2019-08-16 零八一电子集团有限公司 数字化要地防御仿真方法
US20220215102A1 (en) * 2019-05-20 2022-07-07 Cyber Reconnaissance, Inc. System and method for calculating and understanding aggregation risk and systemic risk across a population of organizations with respect to cybersecurity for purposes of damage coverage, consequence management, and disaster avoidance
CN110187649A (zh) * 2019-06-12 2019-08-30 南方电网科学研究院有限责任公司 一种电网的网络攻击仿真系统
US11316883B2 (en) * 2019-07-17 2022-04-26 Bank Of America Corporation Cybersecurity—operational resilience of computer networks
US11316891B2 (en) * 2019-07-18 2022-04-26 Bank Of America Corporation Automated real-time multi-dimensional cybersecurity threat modeling
CN111030837B (zh) * 2019-10-28 2023-04-18 安天科技集团股份有限公司 一种网络环境现状评估方法、装置、电子设备及存储介质
US11290475B2 (en) 2019-11-12 2022-03-29 Bank Of America Corporation System for technology resource centric rapid resiliency modeling
US11394733B2 (en) 2019-11-12 2022-07-19 Bank Of America Corporation System for generation and implementation of resiliency controls for securing technology resources
US11341236B2 (en) 2019-11-22 2022-05-24 Pure Storage, Inc. Traffic-based detection of a security threat to a storage system
US11520907B1 (en) 2019-11-22 2022-12-06 Pure Storage, Inc. Storage system snapshot retention based on encrypted data
US11625481B2 (en) 2019-11-22 2023-04-11 Pure Storage, Inc. Selective throttling of operations potentially related to a security threat to a storage system
US11615185B2 (en) 2019-11-22 2023-03-28 Pure Storage, Inc. Multi-layer security threat detection for a storage system
US11941116B2 (en) * 2019-11-22 2024-03-26 Pure Storage, Inc. Ransomware-based data protection parameter modification
US11755751B2 (en) 2019-11-22 2023-09-12 Pure Storage, Inc. Modify access restrictions in response to a possible attack against data stored by a storage system
US11720714B2 (en) 2019-11-22 2023-08-08 Pure Storage, Inc. Inter-I/O relationship based detection of a security threat to a storage system
US11687418B2 (en) 2019-11-22 2023-06-27 Pure Storage, Inc. Automatic generation of recovery plans specific to individual storage elements
US11657155B2 (en) 2019-11-22 2023-05-23 Pure Storage, Inc Snapshot delta metric based determination of a possible ransomware attack against data maintained by a storage system
US11720692B2 (en) 2019-11-22 2023-08-08 Pure Storage, Inc. Hardware token based management of recovery datasets for a storage system
US11675898B2 (en) 2019-11-22 2023-06-13 Pure Storage, Inc. Recovery dataset management for security threat monitoring
US11651075B2 (en) 2019-11-22 2023-05-16 Pure Storage, Inc. Extensible attack monitoring by a storage system
US11645162B2 (en) 2019-11-22 2023-05-09 Pure Storage, Inc. Recovery point determination for data restoration in a storage system
US11500788B2 (en) 2019-11-22 2022-11-15 Pure Storage, Inc. Logical address based authorization of operations with respect to a storage system
CN110910328B (zh) * 2019-11-26 2023-01-24 电子科技大学 一种基于对抗性样本分类等级的防御方法
CN111209570B (zh) * 2019-12-31 2022-10-21 杭州安恒信息技术股份有限公司 基于mitre att&ck创建安全闭环过程的方法
TWI777117B (zh) * 2020-01-02 2022-09-11 財團法人資訊工業策進會 用於測試待測裝置的網路防禦機制的測試裝置、測試方法及非暫態有形機器可讀介質
US11283828B2 (en) 2020-01-17 2022-03-22 International Business Machines Corporation Cyber-attack vulnerability and propagation model
CN111343158B (zh) * 2020-02-12 2022-06-14 博智安全科技股份有限公司 一种基于虚拟化技术的网络靶场平台
CN111327463B (zh) * 2020-02-12 2024-02-27 博智安全科技股份有限公司 一种基于虚拟化的工业互联网安全实训平台
WO2021216163A2 (fr) * 2020-02-17 2021-10-28 Qomplx, Inc. Système d'analyse et de recommandation de stratégie de cybersécurité défensive piloté par intelligence artificielle
CN111368302B (zh) * 2020-03-08 2024-02-02 北京工业大学 基于攻击者攻击策略生成的自动威胁检测方法
US11563765B2 (en) * 2020-04-10 2023-01-24 AttackIQ, Inc. Method for emulating a known attack on a target computer network
US11677775B2 (en) * 2020-04-10 2023-06-13 AttackIQ, Inc. System and method for emulating a multi-stage attack on a node within a target network
US11070982B1 (en) 2020-04-15 2021-07-20 T-Mobile Usa, Inc. Self-cleaning function for a network access node of a network
US11824881B2 (en) 2020-04-15 2023-11-21 T-Mobile Usa, Inc. On-demand security layer for a 5G wireless network
US11444980B2 (en) 2020-04-15 2022-09-13 T-Mobile Usa, Inc. On-demand wireless device centric security for a 5G wireless network
US11799878B2 (en) 2020-04-15 2023-10-24 T-Mobile Usa, Inc. On-demand software-defined security service orchestration for a 5G wireless network
US20210329022A1 (en) * 2020-04-17 2021-10-21 Cerner Innovation, Inc. Systems, methods, and storage media for conducting security penetration testing
US11115824B1 (en) 2020-05-14 2021-09-07 T-Mobile Usa, Inc. 5G cybersecurity protection system
US11206542B2 (en) 2020-05-14 2021-12-21 T-Mobile Usa, Inc. 5G cybersecurity protection system using personalized signatures
US11057774B1 (en) 2020-05-14 2021-07-06 T-Mobile Usa, Inc. Intelligent GNODEB cybersecurity protection system
KR102331931B1 (ko) * 2020-05-28 2021-11-26 국방과학연구소 사이버 공격에 따른 피해 평가 장치, 방법, 컴퓨터 판독 가능한 기록매체 및 컴퓨터 프로그램
CN111901348A (zh) * 2020-07-29 2020-11-06 北京宏达隆和科技有限公司 主动网络威胁感知与拟态防御的方法及系统
CN112153010B (zh) * 2020-08-31 2023-01-20 北京全路通信信号研究设计院集团有限公司 一种网络安全靶场系统及其运行方法
US11606694B2 (en) 2020-10-08 2023-03-14 Surendra Goel System that provides cybersecurity in a home or office by interacting with internet of things devices and other devices
US11334626B1 (en) 2020-11-02 2022-05-17 Bank Of America Corporation Hybrid graph and relational database architecture
AU2022279291A1 (en) * 2021-05-21 2023-11-30 Mandex, Inc. Host level data analytics for cyberattack detection
CN113259392B (zh) * 2021-06-28 2021-11-02 四块科技(深圳)有限公司 一种网络安全攻防方法、装置及存储介质
CN113536573B (zh) * 2021-07-19 2022-06-14 中国人民解放军国防科技大学 网络攻防过程的仿真建模方法、装置及网络回合制兵棋
CN113660221B (zh) * 2021-07-28 2023-03-14 上海纽盾科技股份有限公司 结合游戏的联合防攻击方法、装置及系统
CN113852504A (zh) * 2021-09-26 2021-12-28 北京工业大学 一种面向等保环境的轻量级工控流程攻防模拟方法
CN114205123A (zh) * 2021-11-20 2022-03-18 湖北天融信网络安全技术有限公司 基于攻防对抗的威胁狩猎方法、装置、设备及存储介质
US11861541B2 (en) * 2021-12-31 2024-01-02 Norwich University Applied Research Institutes Ltd Graphical user interfaces for flexibly organizing and conducting a computer-implemented simulation to support an exercise
CN114338189B (zh) * 2021-12-31 2023-05-26 上海纽盾科技股份有限公司 基于节点拓扑关系链的态势感知防御方法、装置及系统
CN114422255A (zh) * 2022-01-24 2022-04-29 广州理工学院 一种云安全模拟检测系统及检测方法
CN115801464B (zh) * 2023-02-06 2023-06-06 北京长亭未来科技有限公司 一种基于tcp协议攻击的模拟仿真方法、系统、设备及存储介质
CN116827638A (zh) * 2023-06-29 2023-09-29 软极网络技术(北京)有限公司 一种基于网络靶场的网络攻击防御阵图推荐方法

Family Cites Families (14)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JPH10312375A (ja) * 1997-05-14 1998-11-24 Meidensha Corp データの取得方法
KR100312375B1 (ko) 1998-11-12 2001-12-28 서평원 파장분할분기결합다중화장치
US7315801B1 (en) 2000-01-14 2008-01-01 Secure Computing Corporation Network security modeling system and method
US8544087B1 (en) * 2001-12-14 2013-09-24 The Trustess Of Columbia University In The City Of New York Methods of unsupervised anomaly detection using a geometric framework
EP1579608A4 (fr) * 2002-10-11 2012-09-05 Flint Hills Scient Llc Procede, programme informatique et systeme pour la decomposition, le filtrage et l'analyse automatise de signaux d'origine arbitraire ou a echelle de temps arbitraire, sur leur echelle de temps intrinseque
US8327442B2 (en) * 2002-12-24 2012-12-04 Herz Frederick S M System and method for a distributed application and network security system (SDI-SCAM)
US20050262237A1 (en) * 2004-04-19 2005-11-24 Netqos, Inc. Dynamic incident tracking and investigation in service monitors
KR20060027748A (ko) 2004-09-23 2006-03-28 한국전자통신연구원 네트워크 보안 시뮬레이션 중 사용자 입력을 반영하는동적 시뮬레이션 시스템 및 방법
WO2008052291A2 (fr) * 2006-11-03 2008-05-08 Intelliguard I.T. Pty Ltd Système et procédé pour détecter un trafic réseau anormal
US10621203B2 (en) * 2007-01-26 2020-04-14 Information Resources, Inc. Cross-category view of a dataset using an analytic platform
US20090319248A1 (en) * 2008-06-18 2009-12-24 Eads Na Defense Security And Systems Systems and methods for a simulated network traffic generator
US8504504B2 (en) * 2008-09-26 2013-08-06 Oracle America, Inc. System and method for distributed denial of service identification and prevention
US8516596B2 (en) * 2010-01-26 2013-08-20 Raytheon Company Cyber attack analysis
WO2014066500A1 (fr) 2012-10-23 2014-05-01 Hassell Suzanne P Évaluation de modélisation analytique virtuelle destinée à un système de simulation d'opérations (cameo)

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
None *

Also Published As

Publication number Publication date
US20150295948A1 (en) 2015-10-15
WO2014066500A9 (fr) 2015-04-30
EP2912802A1 (fr) 2015-09-02
KR20150074150A (ko) 2015-07-01
WO2014066500A1 (fr) 2014-05-01
KR101681855B1 (ko) 2016-12-01
US9954884B2 (en) 2018-04-24
IL238136B (en) 2018-03-29

Similar Documents

Publication Publication Date Title
EP2912802B1 (fr) Procédé et un dispositif pour simuler un réseau resistant contre les attaques
Nazir et al. Assessing and augmenting SCADA cyber security: A survey of techniques
US10862918B2 (en) Multi-dimensional heuristic search as part of an integrated decision engine for evolving defenses
CA2768193C (fr) Systeme et procede pour etendre un essai d'intrusion automatise afin de developper une strategie de securite economique et intelligente
Ghanem et al. Reinforcement learning for intelligent penetration testing
US11438385B2 (en) User interface supporting an integrated decision engine for evolving defenses
US20160044057A1 (en) Cyber Security Posture Validation Platform
Landauer et al. Have it your way: Generating customized log datasets with a model-driven simulation testbed
Noel et al. Analyzing mission impacts of cyber actions (AMICA)
US11677776B2 (en) Dynamic attack path selection during penetration testing
Hassell et al. Evaluating network cyber resiliency methods using cyber threat, vulnerability and defense modeling and simulation
Dowling et al. Improving adaptive honeypot functionality with efficient reinforcement learning parameters for automated malware
US20210037040A1 (en) Intelligent security automation and continuous verification and response platform
Henry et al. Coupled Petri nets for computer network risk analysis
Shirazi et al. Tor experimentation tools
Rubio et al. Tracking apts in industrial ecosystems: A proof of concept
Qiang et al. Intrinsic security and self-adaptive cooperative protection enabling cloud native network slicing
Kiesling et al. Selecting security control portfolios: a multi-objective simulation-optimization approach
Enoch et al. An integrated security hardening optimization for dynamic networks using security and availability modeling with multi-objective algorithm
Albanese et al. Computer-aided human centric cyber situation awareness
Aly et al. Navigating the Deception Stack: In-Depth Analysis and Application of Comprehensive Cyber Defense Solutions
CA3088179A1 (fr) Automatisation de la securite intelligente et plateforme de verification et d`intervention continue
Ghanem Towards an efficient automation of network penetration testing using model-based reinforcement learning
Нвезе Study of methods for estimating cyber reliability of infocommunication systems
Stiborek Dynamic reconfiguration of intrusion detection systems

Legal Events

Date Code Title Description
PUAI Public reference made under article 153(3) epc to a published international application that has entered the european phase

Free format text: ORIGINAL CODE: 0009012

17P Request for examination filed

Effective date: 20150515

AK Designated contracting states

Kind code of ref document: A1

Designated state(s): AL AT BE BG CH CY CZ DE DK EE ES FI FR GB GR HR HU IE IS IT LI LT LU LV MC MK MT NL NO PL PT RO RS SE SI SK SM TR

AX Request for extension of the european patent

Extension state: BA ME

DAX Request for extension of the european patent (deleted)
STAA Information on the status of an ep patent application or granted ep patent

Free format text: STATUS: EXAMINATION IS IN PROGRESS

17Q First examination report despatched

Effective date: 20170206

GRAP Despatch of communication of intention to grant a patent

Free format text: ORIGINAL CODE: EPIDOSNIGR1

STAA Information on the status of an ep patent application or granted ep patent

Free format text: STATUS: GRANT OF PATENT IS INTENDED

INTG Intention to grant announced

Effective date: 20180608

GRAS Grant fee paid

Free format text: ORIGINAL CODE: EPIDOSNIGR3

GRAA (expected) grant

Free format text: ORIGINAL CODE: 0009210

STAA Information on the status of an ep patent application or granted ep patent

Free format text: STATUS: THE PATENT HAS BEEN GRANTED

AK Designated contracting states

Kind code of ref document: B1

Designated state(s): AL AT BE BG CH CY CZ DE DK EE ES FI FR GB GR HR HU IE IS IT LI LT LU LV MC MK MT NL NO PL PT RO RS SE SI SK SM TR

REG Reference to a national code

Ref country code: CH

Ref legal event code: EP

REG Reference to a national code

Ref country code: IE

Ref legal event code: FG4D

REG Reference to a national code

Ref country code: DE

Ref legal event code: R096

Ref document number: 602013047174

Country of ref document: DE

REG Reference to a national code

Ref country code: AT

Ref legal event code: REF

Ref document number: 1068834

Country of ref document: AT

Kind code of ref document: T

Effective date: 20181215

REG Reference to a national code

Ref country code: NL

Ref legal event code: MP

Effective date: 20181121

REG Reference to a national code

Ref country code: AT

Ref legal event code: MK05

Ref document number: 1068834

Country of ref document: AT

Kind code of ref document: T

Effective date: 20181121

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: ES

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20181121

Ref country code: FI

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20181121

Ref country code: LV

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20181121

Ref country code: NO

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20190221

Ref country code: LT

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20181121

Ref country code: HR

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20181121

Ref country code: BG

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20190221

Ref country code: IS

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20190321

Ref country code: AT

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20181121

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: RS

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20181121

Ref country code: GR

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20190222

Ref country code: PT

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20190321

Ref country code: NL

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20181121

Ref country code: AL

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20181121

Ref country code: SE

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20181121

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: IT

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20181121

Ref country code: CZ

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20181121

Ref country code: PL

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20181121

Ref country code: DK

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20181121

REG Reference to a national code

Ref country code: DE

Ref legal event code: R097

Ref document number: 602013047174

Country of ref document: DE

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: EE

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20181121

Ref country code: SM

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20181121

Ref country code: SK

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20181121

Ref country code: RO

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20181121

PLBE No opposition filed within time limit

Free format text: ORIGINAL CODE: 0009261

STAA Information on the status of an ep patent application or granted ep patent

Free format text: STATUS: NO OPPOSITION FILED WITHIN TIME LIMIT

26N No opposition filed

Effective date: 20190822

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: SI

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20181121

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: TR

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20181121

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: MC

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20181121

REG Reference to a national code

Ref country code: CH

Ref legal event code: PL

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: CH

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20191031

Ref country code: LI

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20191031

Ref country code: LU

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20191023

REG Reference to a national code

Ref country code: BE

Ref legal event code: MM

Effective date: 20191031

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: BE

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20191031

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: IE

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20191023

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: CY

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20181121

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: MT

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20181121

Ref country code: HU

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT; INVALID AB INITIO

Effective date: 20131023

REG Reference to a national code

Ref country code: DE

Ref legal event code: R079

Ref document number: 602013047174

Country of ref document: DE

Free format text: PREVIOUS MAIN CLASS: H04L0012240000

Ipc: H04L0041000000

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: MK

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20181121

P01 Opt-out of the competence of the unified patent court (upc) registered

Effective date: 20230530

PGFP Annual fee paid to national office [announced via postgrant information from national office to epo]

Ref country code: GB

Payment date: 20230920

Year of fee payment: 11

PGFP Annual fee paid to national office [announced via postgrant information from national office to epo]

Ref country code: FR

Payment date: 20230920

Year of fee payment: 11

PGFP Annual fee paid to national office [announced via postgrant information from national office to epo]

Ref country code: DE

Payment date: 20230920

Year of fee payment: 11